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Abstract — 

Digital watermarking is a technology which po¬ 
tentially can be used to enforce the copyrights and 
integrity of digital multimedia data. In this paper, 
a communications perspective on digital watermark¬ 
ing is used to compute upper performance limits on 
blind digital watermarking for simple AWGN attacks 
and attacks by amplitude scaling and additive white 
noise. We show that the latter case can be trans¬ 
lated into effective AWGN attacks, which enables a 
straight forward capacity analysis based on the pre¬ 
viously obtained watermark capacities for AWGN at¬ 
tacks. We analyze the watermark capacity for dif¬ 
ferent theoretical and practical blind watermarking 
schemes. This analysis shows that the practical ST- 
SCS watermarking achieves at least 40 % of the ca¬ 
pacity of an ideal blind watermarking scheme. 

I. Introduction 

Digital media has replaced analog media in many ap¬ 
plications within the last decade. The success of the 
digital representation of analog media is mainly due to 
properties like simple noise-free transmission over gen¬ 
eral purpose channels, compact storaging, perfect copy¬ 
ing, and simple editing. Not only various advantages of 
the new digital technology have been realized, but also 
several drawbacks. Most problems with digital media 
are related to intellectual property rights and trustwor¬ 
thiness of the content. Digital Watermarking is one ap¬ 
proach to enforce copyrights or to ensure the integrity 
of digital media. Here, digital watermarking is consid¬ 
ered as the imperceptible, robust, secure communication 
of information by embedding it in and retrieving it from 
other digital data. The basic idea is that the embedded 
information - the watermark message - travels with the 
multimedia data wherever the watermarked data goes. 
This watermark message is then exploited to resolve 
ownership disputes, to implement playback control, to 
differentiate between different copies of the same con¬ 
tent, or to verify the integrity of the digital data. 

Over the last years, many different watermarking 
schemes for a large variety of data types have been de¬ 
veloped. Most of the work considers still image data, 
but watermarking of audio and video data is popular as 
well. Theoretical limits of digital watermarking have 


been investigated since about 1999 [1, 2, 3], Here, the 
amount of reliably communicable watermark informa¬ 
tion dependent on the statistics of the original data and 
the strength of attacks against the embedded watermarks 
is analyzed. 

In this paper, we present a theoretical analysis of the 
performance limits of different watermarking schemes 
against amplitude scaling and additive white noise at¬ 
tacks. A general communication model for digital wa¬ 
termarking is presented in Section II. In Section III, 
digital watermarking facing an attack by additive white 
Gaussian noise (AWGN) is reviewed. We consider 
four different watermarking technologies. The simple 
AWGN attack is extended in Section IV to attacks by 
amplitude scaling and additive white (Gaussian) noise 
(SAW(G)N). We show that the SAW(G)N attack can be 
translated into an effective AW(G)N attack, so that a per¬ 
formance analysis can be based on the results given in 
Section III. We demonstrate that previous work on this 
subject is not complete due to an inefficient restriction of 
the watermark embedding. Further, the loss of subopti- 
mal embedding schemes compared with an ideal embed¬ 
ding scheme is investigated. The new results presented 
in this paper are concluded in Section V. 

II. A Communications Approach to Digital 
Watermarking 

We consider digital watermarking a communications 
problem. Fig. 1 depicts a general perspective on digi¬ 
tal watermarking. A watermark message m is embed¬ 
ded into the original data x of length L x to produce the 
watermarked data s. The embedding process is depen¬ 
dent on the key K and must be such, that the quality 
difference between x and s ( embedding distortion Dff) 
is not too large. For embedding, a key sequence k of 
appropriate length is derived from the key K. The dif¬ 
ference w = s — x is denoted the watermark signal. The 
watermarked data s might be further processed or even 
replaced by some other data. This process, denoted at¬ 
tack, produces the attacked data r. The attack can be 
any processing such that the quality difference between 
x and r ( attack distortion Da) is acceptable. Usually, 
the goal of the attack is to impair or even remove the 
embedded watermark information. The attacked data r 



is equivalent to the received data r, which is input to the 
watermark reception process. Watermark reception de¬ 
notes both, decoding of a received watermark message 
to using key K and, watermark detection, meaning the 
hypothesis test whether r is watermarked or not. In this 
paper, we focus on the reliable decoding of the water¬ 
mark message. In some applications of digital water¬ 
marking, the original data x might be available to the 
watermark receiver as indicated with the dotted arrow in 
Fig. 1, however, in many applications it is not available. 
We focus on blind watermarking which denotes the sce¬ 
nario where the watermark receiver operates without ac¬ 
cess to the original data x. Here, x,w,s,r, and k are vec¬ 
tors, and x n ,w n ,s n ,r n , and k n refer to their respective 
?7th elements. 



Fig. 1: General model of digital watermarking. 


Digital watermarking is inherently related to stochas¬ 
tic description of multimedia data. There is no use for 
watermarking of data that is perfectly known to attack¬ 
ers. Any modification of the data could be inverted per¬ 
fectly, leading to trivial watermark removal. Thus, es¬ 
sential requirements on data being robustly watermark- 
able are that there is enough randomness in the struc¬ 
ture of the original data and that quality assessments 
can be made only in a statistical sense. Therefore, the 
original data x is considered a realization of a discrete 
random process x. Here, random variables are written 
in Sans Serif font, e.g., x for a scalar random vari¬ 
able and x for a vector random variable. In this paper, 
independent, identically distributed (IID) data elements 
are assumed so that it is sufficiently to characterize the 
element-wise probability density function (PDF) p x ( x ). 
The definition of an appropriate data quality measure de¬ 
pends strongly on the data at hand. However, in many 
cases a (weighted) mean-squared error distortion mea¬ 
sure allows a meaningful quality assessment. Thus, the 
embedding and attack distortions measures are defined 
here by De = E {(s — x) 2 } and D A = E {(r — x) 2 }, 
respectively. Note that D E = <r 2 for a mean-free water¬ 
mark signal w. 

In watermarking applications, the embedder tries to 
communicate as much watermark information as pos¬ 
sible while maintaining a sufficient high data quality. 
Contrary, an attacker tries to impair watermark com¬ 
munication while impairing the data quality as little 
as possible. Therefore, digital watermarking scenar¬ 
ios can be considered a game between the watermark 
embedder and the attacker [2], In [2], the watermark 
capacity C is defined as the supremum of all achiev¬ 
able watermark rates for a given pair (De,£>a)- Any 
processing which achieves (D E ,D A ) has to be consid¬ 


ered. A complete solution to this general watermarking 
game is currently not available. Thus, we consider sub- 
optimal watermarking schemes, e.g., spread-spectrum 
(SS) watermarking, and sub-optimal attack channels, 
e.g. AWGN attacks. In this case, the watermark capac¬ 
ity is the supremum of all achievable rates for the con¬ 
strained watermarking scheme and/or the constrained 
attack. The present constraints are indicated by suf¬ 
fixes, e.g., C^ GN (D E ,D A ) = 6’|! vgn (WNR) de¬ 
notes the capacity of spread-spectrum watermarking fac¬ 
ing an AWGN channel, which is completely determined 
by the watermark-to-noise power ratio WNR for a fix 
document-to-watermark power ratio DWR. 

III. Digital Watermarking facing AWGN 
Attacks 


Watermarking of an IID Gaussian original signal x ~ 
Af(Q, cr x ) and an attack by AWGN v ~ A/"(0, ct 2 ,) is re¬ 
viewed for four different watermarking schemes. The 
AWGN attack is of interest since it is so simple that 
it can be easily applied in any watermarking scenario. 
Thus, the performance of a watermarking scheme facing 
an AWGN attack can be considered an upper bound on 
the general watermark capacity. Further, the extended 
attack considered in Section IV can be analyzed using 
the results obtained for the AWGN attack. 


A. Spread-Spectrum Watermarking 


The term spread-spectrum (SS) watermarking has 
been established in the watermarking community for 
watermark embedding by the addition of a statisti¬ 
cally independent pseudo-noise signal w with power cr 2 
which is derived from the watermark message m and the 
key K. Fig. 2 depicts a block diagram for blind and non¬ 
blind spread-spectrum watermarking. Spread-spectrum 
watermarking is one of the first methods used for wa¬ 
termarking (e.g., [4, 5]) and is still the most popular 
one. For the given assumptions about the original sig¬ 
nal, the attack noise, and for a Gaussian watermark sig¬ 
nal w ~ Af( 0, er 2 ) the SS watermark capacity is given 
by the capacity of an AWGN channel, which is [6] 
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for non-blind SS watermarking, and 


r ,AWGN _ 1 i / 1 , 
° blind SS — 2 i0 ® 2 ' 1 + 


( 1 ) 


( 2 ) 


for blind SS watermarking. The suffix “blind” is sup¬ 
pressed in the remainder since the focus of this paper is 
on blind watermarking. 

Note that <r 2 er 2 and cr 2 cr 2 due to the quality 
constraints for watermark embedding and attacks on wa¬ 
termarks, respectively. Thus, the performance of blind 
SS watermarking facing an AWGN attack is mainly 
determined by the DWR = 10 log 10 er 2 /er 2 [ dB]. 
This shows that blind watermark reception suffers 
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Fig. 2: Blind/non-blind watermark transmission in the 
presence of an AWGN attack. 


significantly from original signal interference. Con¬ 
trary, the performance of non-blind SS watermark¬ 
ing facing an AWGN attack is completely indepen¬ 
dent from the characteristics of the original signal x. 
Here, the performance depends solely on the WNR. = 
101ogi 0 al/al[ dB], 

B. Watermarking as Communication with Side- 

Information at the Encoder 

In 1998, it has been realized [7, 8] that consider¬ 
ing blind watermarking as communication with side- 
information at the encoder enables the design of im¬ 
proved blind watermarking schemes with reduced inter¬ 
ference from the original signal. Fig. 3 depicts a block 
diagram of blind watermark communication, where the 
encoder exploits the side-information about the original 
signal. 
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Fig. 3: Watermark communication facing an AWGN at¬ 
tack as communication with side-information. 


Chen and Wornell introduced an important but almost 
forgotten paper by Costa into the watermarking commu¬ 
nity. Costa[9] showed theoretically that for the commu¬ 
nication scenario depicted in Fig. 3 with a Gaussian orig¬ 
inal signal of power cr x , a watermark signal of power cr^, 
and AWGN of power a 2 the capacity is 

C,S GN = iloS 2 (l + ^). 0) 

independent of a 2 . The suf£x “ICS” stands for ideal 
Costa scheme , and is used here to distinguish the 
theoretical performance limit from that of suboptimal 
schemes discussed below. The result (3) is surprising 
since it shows that the original data x need not be consid¬ 
ered as interference at the decoder although the decoder 
does not know x. Costa presents a theoretic scheme 
which involves a random codebook U Lx which is 

U Lx = {u ; =w/ + axi | l £ {1,2,..., Lu}, 

M~Af(0,a 2 w I Lx ),x~Ar(0,a 2 x I Lx )},(4) 

where w and x are realizations of two La--dimensional 
independent random processes x and w with Gaussian 


PDF. Ljj is the total number of codebook entries and I [ Jr 
denotes the L x -dimensional identity matrix. For secure 
watermarking, the codebook choice must be dependent 
on a key K. There exists at least one such codebook such 
that for L x —> oo the capacity (3) is achieved. Note that 
the optimum choice of the parameter a depends on the 
WNR and is given by 

_ * _ 

' 1 = ” ' 1 ~ al + a2 “ 1 + 10-WNR/io ■ 

C. Practical Communication Derived from Costa’s 

Scheme 

Costa’s scheme allows significant gains over common 
blind SS watermarking. Unfortunately, for good perfor¬ 
mance, U must be so large that neither storing it nor 
searching it is practical. In [10], we proposed to replace 
Costa’s random codebook by a structured codebook, in 
particular a product codebook of dithered uniform scalar 
quantizers, and called this scheme SCS (Scalar Costa 
Scheme). Similar suboptimal approaches to implement 
Costa’s scheme have been developed by Chen and Wor¬ 
nell [7] and by Ramkumar and Akansu [11]. A detailed 
description and performance analysis of SCS is given in 
[10, 12], Here, only an outline of SCS is given. 

In SCS, the watermark message m is encoded into a 
sequence of watermark letters d, where the elements d n 
belong to a D-ary alphabet V = {0,1,..., D — 1}. In 
many practical cases, binary SCS watermarking (d n £ 
V = {0,1}) is sufficient. Each of the watermark let¬ 
ters is embedded into the corresponding original signal 
elements x n . For example, x n could be a signal sam¬ 
ple or a frequency coefficient of multimedia data. The 
embedding rule for the nth element is given by 

X n 

Qn 

Sn 

where <2 a {•} denotes scalar uniform quantization with 
step size A. The key k is a pseudo-random sequence 
with k n £ (0,1]. Note that the obtained watermark sig¬ 
nal w is mean-free and statistically independent from 
the original signal x. The SCS embedding scheme de¬ 
pends on two parameters: the quantizer step size A and 
the scale factor a. For given a and embedding distor¬ 
tion (j^, the step size is A = \f\2<7 w /a. The parameter 
a is optimized for each WNR to achieve a good trade¬ 
off between embedding distortion and decoding reliabil¬ 
ity. The optimal value of a in SCS must be computed 
numerically[10]. A good approximation is given by 



— Qa X n 

= x n + aq n , (6) 
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al + 2.71 al 


(7) 


For positive WNRs, a* is even a slightly better approx¬ 
imation, but for negative WNRs, a* is too large. 

At the decoder, the received data r is extracted to ob¬ 
tain the data y. The extraction rule for the nth element 







is 

y n = 2a {r n - fc„A} + k n A - r„. (8) 

For binary SCS, \y n \ < A/2, where y n should be close 
to zero if d n = 0 was sent, and close to ±A/2 for d n = 
1. The extracted data y can be used as soft-input for 
common channel decoding algorithms. 

The capacity C|cg GN (WNR) has to be computed nu¬ 
merically [10]. The obtained results are shown in Sec¬ 
tion III.E. 

D. Spread-Transform Watermarking 

Redundant embedding of watermark message bits is 
required in most watermarking application. A general 
approach to spread watermark message bits over many 
original signal elements is called spread-transform (ST) 
watermarking. ST watermarking has been proposed by 
Chen and Wornell [7]. In ST watermarking, the water¬ 
mark is not directly embedded into the original signal x, 
but into the projection x ST of x onto a random sequence 
t. The spreading factor r denotes the number of ele¬ 
ments of x being projected on t to obtain one element of 
x ST . 

The basic idea behind ST watermarking is that any 
component of the channel noise v being orthogonal to 
the spreading vector t does not impair watermark decod¬ 
ing. Thus, an attacker, not knowing the exact spreading 
direction t, has to introduce much larger distortions to 
impair a ST watermark as strong as a watermark embed¬ 
ded directly into x. For an AWGN attack, the effective 
WNR t after ST with spreading factor r is given by 

WNR r = WNRi + 10 log 10 r. (9) 

Thus, doubling the spreading length r gives an addi¬ 
tional power advantage of 3 dB for the watermark in 
the ST domain. 

Below, the combination of ST watermarking with 
SCS watermarking is denoted as ST-SCS watermarking. 
ST watermarking effectively performs a mapping of the 
WNR according to (9). This can be exploited to com¬ 
pute the capacities of ST-SCS watermarking via 

i (WNR + 10 log 10 r) 

C st^scs, T (WNR) = ST ~ SCS ’ 1V - 

( 10 ) 

The spreading factor r is chosen to achieve maximum 
capacity. We showed in [12] that r = 1 for all WNR > 
WNR crit . For WNR < WNR cr i t , the optimal r is such 
that the effective WNR is equal to WNR cr ; t . We deter¬ 
mined numerically that WNR cr j t ~ 0.01 for SCS wa¬ 
termarking. Cg^ v _ G Q g (WNR) denotes the capacity of 
ST-SCS watermarking with optimum spreading factor r. 

E. Watermark Capacity Comparison for AWGN Attacks 

A detailed capacity analysis of SCS and ST-SCS 
watermarking and a comparison to SS and ICS wa¬ 
termarking in case of AWGN attacks is given in our 
previous work [10, 12], Here, we summarize the 
most important results. Fig. 4 shows the capacities 


<Cjcs GN (WNR), C'gQg GN (WNR), C^wgn s (WNR), 
and Cgg VGN (WNR). The original signal power has 
only an influence for SS watermarking. The shown ca¬ 
pacity C^ gn (WNR) is for DWR = 15 dB. We 
observe, that ST-SCS and SCS watermarking do not 
achieve the capacity of ICS, but are not too far from 
ICS either. ST-SCS watermarking gives an advantage 
over SS watermarking only for WNR < WNR cr ;t ~ 
0.01 dB. Blind SS watermarking suffers significantly 
from original signal interference. For weak to mod¬ 
erately strong attacks (i.e., WNRs greater than about 
— 10 dB) SCS watermarking outperforms SS water¬ 
marking by far since the capacity of SCS is not re¬ 
duced by original signal interference. For very strong 
attacks (WNR < —15 dB), blind SS watermarking 
achieves higher capacities than (ST-)SCS watermarking 
since here the attack distortion becomes more important 
than the original signal interference. However, note that 
ICS outperforms blind SS watermarking at all attack dis¬ 
tortion levels. Costa’s proof shows that ICS is the opti¬ 
mal scheme under all possible schemes for the consid¬ 
ered communication scenario. 



Fig. 4: Capacity of blind watermarking schemes facing 
an AWGN attack. 


IV. Watermarking facing SAW(G)N Attacks 

Watermarking of mean-free IID original signals with 
power cr 2 = E{x 2 } is considered. The PDF of the 
original signal is not speci led, in particular, we do not 
constrain the discussion to Gaussian signals. However, 
we investigate the watermarking game for attacks con¬ 
strained to an amplitude scaling by a £x factor g a and 
independent additive white noise v with variance er 2 as 
depicted in Fig. 5. Subsequently, we denote this attack 
as amplitude scaling and additive white noise (SAWN) 
attack. Several of the subsequently derived results are 
independent from the noise PDF. When results are spe¬ 
cific to Gaussian noise we denote the attack as amplitude 
scaling and additive white Gaussian noise (SAWGN) at¬ 
tack. Further, we do not necessarily restrict the attacker 
to use mean-free noise. However, we assume that the 
addition of a DC component can be inverted perfectly 
at the receiver, thus a DC-offset in the added noise se- 





quence has no effect on the performance of the water¬ 
marking scheme and consequently is neglected here. 

A. SAWN Attacks and Effective AWN Attacks 

Fig. 5 depicts the investigated communication sce¬ 
nario. The shown scenario is more general than those in¬ 
vestigated by Moulin et al. [2, 13] and Su et al. [14] due 
to the amplitude scaling by g e at the embedder’s side. 
The embedder chooses w' and g e to transmit the water¬ 
mark message m with embedding distortion De- The 
attacker chooses g a and v constrained to the attack dis¬ 
tortion Da to disturb the watermark communication as 
much as possible. To solve the game between embedder 
and attacker, we assume that both know their opponents 
strategy. In our analysis, this means that the attacker 
knows the used watermarking scheme, the power a 2 of 
the original signal and the introduced embedding distor¬ 
tion De, but does not know the exact realization of the 
original signal x and of the watermark signal w. The 
receiver knows the scale factor g = g e g a , the noise vari¬ 
ance a 2 and a possibly non-zero mean of v, but does 
not know the exact realizations of x and v. The embed¬ 
der knows all parameters known to the receiver plus the 
original signal x and the watermark message m to be 
sent. The assumptions about the knowledge of the at¬ 
tacker are in line with Kerkhoff’s principle, which states 
that the security of a system should only depend on a 
secret key and not on the secrecy of the algorithm itself. 
A method for the estimation of the parameter required at 
the watermark receiver is described in [15], 


Attack 



Fig. 5: Watermark communication facing an amplitude 
scaling and additive white noise attack. The receiver 
compensates for the introduced amplitude scaling before 
decoding to. 

The watermarking game in case of SAWN at¬ 
tacks is analyzed with respect to the watermark 
capacity C sawn ((7 2 ,De,Da)- It is obvious that 
C' SAWN (cr^, £) e , £) a ) = 0 for g a = 0 since the entire 
signal is deleted. Thus, it is meaningless to design a wa¬ 
termarking scheme if such a strong attack is allowed. If 
g a f 0, the receiver can compensate for the amplitude 
scaling attack by dividing r by g = g e g a to produce the 
pre-processed signal 

r' = g- 1 r 

= g~ x {g a s + v) 

= g~ 1 {g a ge(x + w') + v) 

= x + w' + v', (11) 

with v' = g~ l v. Thus, after compensating for the am¬ 
plitude scaling, the watermark receiver sees an AWN 


attack with the effective noise v' with variance <j 2 , = 
er 2 / 'g 2 . We observe that scaling by g < 1 increases the 
effective noise power. 

Fig. 5 and (11) reveal the similarity of the investi¬ 
gated blind watermarking scenario and the communica¬ 
tion scenario with side-information at the encoder and 
AWGN channel, w' is the transmitted signal, x is the 
channel state known to the encoder, and v' = g~ 1 v is 
the channel noise. Therefore, a blind watermarking sys¬ 
tem facing an SAWN attack can be designed similarly 
to a communication system with side-information at the 
encoder and effective AWN attack with noise variance 



The watermark capacity for communication over an 
effective AWN channel with £x noise PDF depends only 
on the chosen embedding scheme, the original signal 
and the power ratio 





( 12 ) 


a 2 , and a 2 , of the effective AWN attack model can be 

W V 

related to De, Da, g e , an d .9 = for watermarking 
facing an SAWN attack. We assume E { w'x} = 0 in 
the following derivations, which is fulfilled for all wa¬ 
termarking schemes discussed in Section III. Then, the 
embedding distortion De is given by 


De 


E {(s-x) 2 } = E {((1 ~ g e )x ~ g e w) 2 } 

(1 -g e ) 2 al + glal,. (13) 


Solving for gives 


a 


2 

w' 


DE-(l-ge) 2 a 2 x 

g 2 


(14) 


For independent noise v, the SAWN attack distortion is 
given by 

D a = E {(x — r) 2 } 

= E{(x-g(x+ w') - v) 2 } 

2/i \2 , 2 2 , 2 2 

= PxD-g) +a w ,g +a v ,g , 

which gives 

2 _ d a ~ cr 2 {l - g) 2 - a 2 w ,g 2 

g 2 

Finally, the power ratio in (12) can be expressed with 
(14) and (16) as 

C(a x ,D E ,D A ,g e ,g) = (17) 

_ g 2 (DE-cr 2 (l-ge) 2 ) _ 

{a 2 - D E )g 2 - (a 2 - D A )g 2 + 2a 2 gg e {g e - g) ’ 

which enables the computation of the watermark capac¬ 
ity for an SAWN attack based on the capacity for the 
effective AWN attack model. 


(15) 


(16) 







B. Solving the Watermarking Game for SAWN Attacks 

The capacity C AWX (([) is for all efficient water¬ 
marking schemes monotonously increasing. Therefore, 
it is possible to reformulate the watermarking game 
constrained to SAWN attacks and specific embedding 
schemes using ((<j 2 ,De,Da) as objective function. For 
a certain embedding scheme and fix D e, the embed- 
der chooses g e which maximizes ((((7 2 ,De,Da)- The 
attacker chooses g a which achieves Da and minimizes 

C, (ct x ,De,D a)- Thus, the solution to the considered wa¬ 
termarking game is equivalent to the solution of the min- 
max problem 


Copt(^x5 De , Da) 

= minmax£((r*, D e , Da, g e ,9a) 

9a 9e 

= minmaxC((j^, D E) H a , 9e,g)- (18) 

9 9e 


The solution of the min-max problem in (18) is equiv¬ 
alent to the saddlepoint of ((a x ,DE,DA,g e ,g) over all 
positive (p e ,p=< 7 e< 7 a) if such a unique saddlepoint ex¬ 
ists. Common analysis shows that a unique saddlepoint 
is given by 


^e^pt = 

o x - H e 
o ’ 


(19) 

CT 



9opt — 

a 2 -D a 

O 5 

CT 


( 20 ) 

9a, opt 

5opt _ 

9e, opt a 2 

- D e 

D a 

( 21 ) 


We observe that g e ,opt is independent from any attack 
parameter and <? a ,opt depends only on a 2 , De, and Da, 
which are all independent from a specific watermark em¬ 
bedding scheme with E{w'x} = 0. Thus, embedder 
and attacker can easily choose their optimum scale fac¬ 
tors g e and g a , respectively. We assume in the remainder 
that always the optimum values of g e and g a are chosen 
so that the suffix “opt” can be neglected. 

The optimum values of rr 2 , and ct 2 , can be derived 
from (14),(16), (19), and (20) to be 


2 _ o 2 x De 

CT -' " oI-De ’ 

2 = o 2 x 2 (D a -De) 

^ (a x — Da)(ct x — De) ' 

Thus, the solution to (18) is 


Copt , De, Da) 


D E (a 2 - Da) 
<t*(D a -DeY 


( 22 ) 

(23) 


(24) 


Note that for g e ,opt, the embedding distortion De 
never exceeds the original signal power ct 2 , which can 
be concluded from (19). Further, it can be observed that 
<?e,opt ~ 1 for practically relevant ratios De/ct 2 . Thus, 
the amplitude scaling by g e at the embedder’s side does 
not give a significant performance improvement over the 
schemes considered in [2, 13, 14], but in principle an 


improvement is achieved. Further note that we defined 
the watermark signal w to be the difference between the 
original and the watermarked signal which is here 

W = s-x= (g e - l)x + g e w'. (25) 

Thus, for E {w'x} = 0 , x and w are correlated for all 
g e 7 ^ 1 , which contradicts earlier results obtained in [ 2 ], 
We observe that the minimum attack distortion Da, 
achieved for the weakest attack (a 2 , = 0), is D\ = De- 
Therefore, meaningful embedding distortions and attack 
distortions are constrained to 


0 < De < D a < cr 2 . (26) 


Note that the upper limit on De has no meaning in prac¬ 
tical watermarking scenarios. In general, the embed¬ 
der can choose any distortion level between zero and a 2 
since he has the first move in the considered game. 


C. Watermarking ofUD Gaussian Signals 

The optimization of the parameter a 2 and g a of an 
SAWN attack required only weak assumptions on the 
statistics of the original signal and the considered water¬ 
marking schemes. In particular, we exploited the knowl¬ 
edge of the original signal power a 2 , of the embedding 
distortion De, and constrained the embedding schemes 
to schemes with E {xw'} = 0 and a monotonously in¬ 
creasing C AWN (C). Now, the specific case of Gaus¬ 
sian original signals and blind watermarking using an 
ideal Costa scheme is considered. Further, it is assumed 
that the attacker uses Gaussian noise. For such a sce¬ 
nario, the capacity for communication over an effective 
AWGN channel is given by 

^ICS GN = \ log 2 (l + ^) ■ (27) 

With (22) and (23) for , and a 2 ,, respectively, we ob¬ 
tain the capacity in case of SAWGN attacks, which is 


n SAWGN 
L 'ICS 




, He, Ha) 



/ H a (^-H e ) \ 

\a 2 (DA-D E )J 


(28) 

The watermarking game for Gaussian original sig¬ 
nals has been first investigated by Moulin et al. [2], how¬ 
ever, with a differently defined attack distortion mea¬ 
sure. Moulin et al. derive that the optimum attack un¬ 
der all possible attacks is a specific SAWGN attack, the 
Gaussian test channel (GTC). Later, in [13], Moulin et 
al. consider the same attack distortion measure used 
here and derive that a specific SAWGN attack is again 
the optimum attack under all possible attacks. However, 
details of the proof are currently not available to the au¬ 
thors. Note, that the capacity in (28) is slightly larger 
than the one given in [13], which suggests that the so¬ 
lution in [13] is not as general as assumed before. The 
important difference between the analysis here and the 
one given in [13] is the introduced amplitude scaling 
by g e as final step during watermark embedding. The 



model in [13] does not consider such an amplitude scal¬ 
ing an thus restricts the embedding process in an inef- 
£cient way. The scaling by g e prevents that an attacker 
first improves the quality of the watermarked signal s 
before adding noise with increased power. 



Fig. 6: Watermark capacities for Gaussian original sig¬ 
nals and ICS watermarking. 




Fig. 7: Effective WNR and optimum scale factor g opt 
for DWR = 20 dB. 

Fig. 6 depicts C VGN for three different DWRs. 
The capacities are plotted over the entire range of 
achievable document-to-attack power ratios (DAR = 
10 log 10 (ct^/.Da)[ dB]). Note that the DWR and the 
DAR can be considered as a document quality measure, 
where large values indicate good document quality. The 
watermark capacity goes to infinity when DAR tends to 
the DWR, that means no attack occured. Contrary, the 
watermark capacity goes to zero for DAR approaching 
its lower limit zero when the entire signal is erased. 

The upper plot in Fig. 7 shows the relationship be¬ 
tween the DAR after the optimized SAWGN attack and 
the corresponding effective WNR for communication 
over an AWGN channel. Note that the effective WNR 
goes to plus or minus infinity as the DAR achieves it 
upper or lower limit, respectively. The lower plot in 
Fig. 7 depicts the corresponding optimal scale factor g a . 
For weak attacks, where the quality loss is less than 
6 dB, the attacker mainly adds noise. However, when 
increased attack distortions are accessible, the attacker 
more and more scales down the watermarked signal. At 
the limit DAR = 0, the entire watermarked signal is 
erased by choosing g a = 0. 


D. Suboptimum Watermarking Schemes 


In this section, the performance of suboptimum wa¬ 
termarking schemes facing an SAWGN attack is dis¬ 
cussed. We compare SS, SCS, and ST-SCS watermark¬ 
ing with ICS watermarking. 

The capacity Cf AWGN can be derived from (2), 
which gives 


n SAWGN / 2 
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The capacity C gcg GN has been derived numerically, 
thus, an analytical expression of C pw-^scs * s not ava il' 
able. In the following comparison, we exploit the de¬ 
rived mapping of the DAR after SAWGN attack onto the 
effective WNR for AWGN channels to compute the ca¬ 
pacities C***™^, -D e , -Da). For this, the capacity 

CgQg GN (WNR) is computed numerically for WNR = 
—20 dB ... 20 dB. Effective WNR > 20 dB occur for 
DARs close to the DWR, Here, linear extrapolation of 
CgQg GN (WNR) for WNR > 20 dB with its derivative 
at WNR = 20 dB is applied. For WNR < —20 dB, a 
reasonable extrapolation of the numerically derived ca¬ 
pacity curve can be obtained with help of the spread 
transform. Thus, in a strict sense, the shown curves 
for C|AW gn are valid for ST-SCS watermarking where 
the ST is active only for WNR < —20 dB. Contrary, 
C st^scs denotes the capacity of ST-SCS watermark¬ 
ing where the ST is active for all WNR < WNR cr i t ~ 
0.01 dB. 

Fig. 8 compares the performance of the considered 
watermarking schemes for three different levels of the 
embedding strength (DWR = 10 dB, 20 dB, 30 dB). 
The plots in the left column of Fig. 8 show the capac¬ 
ity in units of bit/element. The capacity C'|g WGN is 
limited over the entire range of DARs due to the origi¬ 
nal signal interference. Consequently, SS watermarking 
performs significantly better for decreased DWR, The 
minimum usable DWR is application dependent. Con¬ 
trary, all other considered techniques could achieve in 
principle an infinite large capacity for DARs close to the 
DWR, The capacity of ICS and (ST-)SCS watermark¬ 
ing depends on the DWR, as well. However, in partic¬ 
ular for strong attacks (DAR —> 0), the inHuence of the 
DWR is almost negligible. The inHuence of the DWR 
increases for increased DARs which is obvious since the 
capacities tend to infinity when the DAR achieves the 
DWR, We can also observe that the capacities of (ST)- 
SCS watermarking follow in general the behavior of the 
capacity of ICS. At a certain DAR, depending on the 
DWR, (ST-)SCS performs worse than SS watermarking. 
However, it is unlikely that such low DARs are allowed 
in practical scenarios. 

The capacity ratio vc = C SAWGN / C I s ( (g VGN of 
the suboptimal schemes and an ideal Costa scheme is 
depicted in the right column of Fig. 8. First, we observe 
that (ST-)SCS achieves for weak attacks almost the ca¬ 
pacity of ICS, where for stronger attacks a significant 
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Fig. 8: Capacity comparison for watermarking facing 
the SAWGN attack for DWR= 10 dB, 20 dB, 30 dB 
in case of white Gaussian original signals (ICS: “■ • 
SS:“-”; SCS:“—•ST-SCS:“- 

capacity reduction is visible. However, we can also ob¬ 
serve that the capacity reduction for ST-SCS and SCS 
is limited and never below 40% and 28%, respectively. 
This result is independent from the considered DWR. 
SS watermarking achieves the performance of ICS for 
very strong attacks (DAR « 0). However, for weaker 
attacks, the capacity loss becomes more and more se¬ 
vere. For very weak attacks, the relative capacity of SS 
compared to an ideal scheme tends to zero. 

V. Conclusions 

A communications perspective of digital watermark¬ 
ing is presented, where the performance of digital wa¬ 
termarking schemes is characterized by the watermark 
capacity for certain embedding schemes and constrained 
attacks. The watermark capacity of four different blind 
watermarking schemes facing AWGN attacks is re¬ 
viewed. The considered blind watermarking schemes 
are common blind spread-spectrum (SS) watermarking, 
the ideal Costa scheme (ICS) which exploits the side- 
information about the original signal at the encoder, 
the practical but suboptimal scalar Costa scheme (SCS) 
and its combination with spread-transform watermark¬ 
ing (ST-SCS). Next, attacks by amplitude scaling and 
additive white (Gaussian) noise (SAW(G)N) are dis¬ 
cussed. We show that these attacks can be translated 
into effective AWGN attacks, so that the previously pre¬ 
sented capacity results for AWGN attacks can be used 
for the capacity analysis of SAWGN attacks. We also 
show, that optimal watermark embedding in case of 


SAWGN attacks produces watermark signals which are 
correlated with the original signal. This contradicts pre¬ 
vious results presented by Moulin et al. [2]. The water¬ 
mark capacities for ICS, (ST-)SCS, and SS embedding 
and SAWGN attacks are compared. An important re¬ 
sults is that the practical ST-SCS watermarking scheme 
achieves at least 40 % of the capacity of ICS. 
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